[ToDo]: move is_affiliated()

definitely the wrong place - nothing to do whatsoever with permissions.

Why move it at all? It is only used in req and nowhere else, so it seems specific. And even if not - it should either go into org (most logical to me) or into AuthS3 (still logical), but certainly not S3Permission.